Add validation for Container.Env

This includes backwards compat with the older "key" field.

Builds on #330